chore: 保存工作副本——客户端授权新契约(双端点/验签/令牌/周检)与桌面会话可靠性改进

scripts/macos-codesign-wrapper.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Tauri 默认 `codesign --timestamp` 走 timestamp.apple.com:443。
+# 部分网络（含仅开 HTTP 代理、443 不通）会报 “The timestamp service is not available.”
+# 构建时把本脚本以 `codesign` 之名放进 PATH，改为 RFC 3161 HTTP 时间戳。
+# 关闭：CODESIGN_USE_SYSTEM_TIMESTAMP=1
+set -euo pipefail
+REAL="/usr/bin/codesign"
+TS="${APPLE_TIMESTAMP_URL:-http://timestamp.apple.com/ts01}"
+
+if [ "${CODESIGN_USE_SYSTEM_TIMESTAMP:-}" = "1" ]; then
+  exec "$REAL" "$@"
+fi
+
+signing=0
+for a in "$@"; do
+  case "$a" in
+    --sign|-s) signing=1 ;;
+  esac
+done
+
+if [ "$signing" -eq 0 ]; then
+  exec "$REAL" "$@"
+fi
+
+new=()
+found=0
+for a in "$@"; do
+  if [ "$a" = "--timestamp" ] || [[ "$a" == --timestamp=* ]]; then
+    new+=("--timestamp=$TS")
+    found=1
+  else
+    new+=("$a")
+  fi
+done
+if [ "$found" -eq 0 ]; then
+  new+=("--timestamp=$TS")
+fi
+exec "$REAL" "${new[@]}"